A Using Oracle Web Services Manager Security Policies
This appendix includes the following sections:
Overview of OWSM Security Policies
Oracle Fusion Middleware installs a portability layer on top of WebLogic Server that integrates OWSM security policies into the WebLogic Server environment. This portability layer provides OWSM security policies that you can use to protect WebLogic JAX-WS web services and clients.
You can use the OWSM security policies as an alternative to the WebLogic WS-Security policies for enforcing security for web services. You can also create custom OWSM security policies and use them with WebLogic web services.
The following sections provide more information about the OWSM policies that are available and when you should use them.
Which OWSM Policies Are Supported for Java EE Web Services?
Only a subset of OWSM policies are supported for Java EE web services. See Which OWSM Policies Are Supported for Java EE Web Services? in Securing Web Services and Managing Policies with Oracle Web Services Manager.
When Should You Use OWSM Security Policies?
You might want to use OWSM security policies to protect JAX-WS web services if you already use SOA, ADF, or Web Center applications elsewhere in your environment and you want a consistent security environment.
You should secure a WebLogic JAX-WS web service with OWSM security policies to have consistent and interoperable web service security when these web services are used in conjunction with Oracle Fusion Middleware applications.
That is, you should secure WebLogic JAX-WS web services with OWSM security policies for use with applications that interact with Oracle Fusion Middleware applications, not with standalone WebLogic Server web service applications.
Consider the following scenarios:
-
If you develop WebLogic JAX-WS web services or clients that interact with SOA Composite Services, ADF Components, or WebCenter Services, then you should use the OWSM security policies.
-
If you develop only WebLogic native Java JAX-WS web services, then you should use WebLogic WS-Security policies.
Table A-1 lists policy selection guidelines for using the OWSM policies. In this table:
-
weblogic.jws.Policyannotation applies to WebLogic web service policies -
weblogic.wsee.jws.jaxws.owsm.SecurityPolicyannotation applies to OWSM policies
Table A-1 Policy Selection Guidelines
| @Policy | @SecurityPolicy | Feature to be Implemented | Which Policies to Use |
|---|---|---|---|
|
Yes |
No |
WSS 1.0 with multiple must support key reference methods |
|
|
Yes |
No |
Username Token digest authentication |
|
|
No |
Yes |
Kerberos Authentication |
|
|
Yes |
No |
WSS 1.1 Derived Key |
|
|
Yes |
No |
All SAML 2.0 scenarios |
|
|
Yes |
No |
Encrypt before signing |
Policy assertion <sp:EncryptBeforeSigning/> in both WSS10 or WSS11, Symmetric Binding or Asymmetric Binding, such as the following: <wsp:Policy xmlns:wsp="..." >
<sp:SymmetricBinding>
<wsp:Policy>
.. .
<sp:EncryptBeforeSigning/>
. . .
</wsp:Policy>
</sp:SymmetricBinding>
. . .
</wsp:Policy> |
|
Yes |
No |
Multiple policy alternatives |
Policy assertion such as the following: <wsp:Policy xmlns:wsp="..." >
<wsp:ExactlyOne>
<wsp:All>
... ALternative 1 ...
</wsp:All>
<wsp:All>
... ALternative 2 ...
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy> |
For non-security features, such as WS-RM and MTOM, use WebLogic web service policies.
For specific policy instances, you can attach an OWSM policy to the web service client or service, and an WebLogic web service policy to the WebLogic Java EE web service or client, and they will interoperate. The specific interoperability scenarios are described in Interoperability with Oracle WebLogic Server 11g Web Service Security Environments in Interoperability Solutions Guide for Oracle Web Services Manager.
For these interoperability scenarios, you can use either OWSM or WebLogic web service policies, depending on the following considerations:
-
If additional non-standard policy assertions in the OWSM policy are needed for configuration, then use the
@SecurityPolicyannotation.Examples of these non-standard assertions might be as follows:
<oralgp:Logging xmlns:oralgp="http://schemas.oracle.com/ws/2006/01/loggingpolicy" . . . orawsp:category="security/logging"> . . . </oralgp:Logging>or
<orawsp:Config xmlns:orawsp="http://schemas.oracle.com/ws/2006/01/policy" . . .> <orawsp:PropertySet . . .> . . . </orawsp:PropertySet> </orawsp:Config> -
If the application will be used to interoperate with existing WebLogic web services or Microsoft Windows Communication Foundation (WCF)/.NET Framework services, and the previously-mentioned non-standard policy assertions are not required, then use the
@Policyannotation with WebLogic web service policies.
Interoperability Between WebLogic Web Service Policies and OWSM Policies
A subset of WebLogic web service policies interoperate with OWSM policies.
That is, for specific policy instances, you can attach an OWSM policy to the web service client or service, and a WebLogic web service policy to the WebLogic Java EE web service or client, and they will interoperate.
The specific interoperability scenarios are described in Interoperability with Oracle WebLogic Server 11g Web Service Security Environments in Interoperability Solutions Guide for Oracle Web Services Manager.
WebLogic Server includes the policies shown in Table A-2 for interoperability with OWSM.
Table A-2 Interoperability WebLogic WS-Security Policies
| Policy Name | Description |
|---|---|
|
|
This policy provides similar security features to that of |
|
|
This policy provides similar security features to that of It endorses with the sender's X509 certificate, and message signature is protected. It requires the use of the Basic128 algorithm suite (AES128 for encryption) instead of the Basic256 algorithm suite (AES256). |
|
|
This policy provides similar security features to that of |
|
|
Two-way SSL that uses SAML 1.1 token with sender vouches confirmation method for authentication. It requires client certificates, and the recipient checks for the initiator's public certificate. |
|
|
This policy provides similar security features to that of |
|
|
This policy provides similar security features to that of |
|
|
This policy provides similar security features to that of |
|
|
This policy provides similar security features to that of |
|
|
This policy provides similar security features to that of |
|
|
This policy provides similar security features to that of |
|
|
This policy provides similar security features to that of |
|
|
This policy provides similar security features to that of |
|
|
This policy provides similar security features to that of |
Attaching OWSM Security Policies to JAX-WS Web Services
The OWSM WS-Security policy attachment model is similar to that of the WebLogic web service policies. You can attach OWSM policies to WebLogic JAX-WS web services using one of the following methods:
-
Policy annotations at design time, as described in Attaching Policies to Java EE Web Services and Clients Using Annotations in Securing Web Services and Managing Policies with Oracle Web Services Manager.
-
WebLogic Server Administration Console at runtime, as described in Attaching OWSM Security Policies Using the Administration Console.
-
Fusion Middleware Control or WLST at runtime, as described in the following sections in Securing Web Services and Managing Policies with Oracle Web Services Manager:
You can attach only one type of security policy to a web service, either WebLogic web service security policies or OWSM policies. You cannot attach both WebLogic web service policies and OWSM policies to the same web service, through either the annotation mechanism, the WebLogic Server Administration Console, Fusion Middleware Control, or a combination of the three.
You can attach an OWSM security policy only to a JAX-WS web service; you cannot attach this type of policy to a JAX-RPC web service.
The following sections describe how to use the WebLogic Server Administration Console to attach OWSM security policies to JAX-WS web services:
Attaching OWSM Security Policies Using the Administration Console
Attaching OWSM policies to a deployed web service at runtime using the WebLogic Server Administration Console is similar to attaching WebLogic web service policies, as described in Configuring Message-Level Security.
You can choose to not use @SecurityPolicy or @SecurityPolicies annotations in your JWS file and attach policies only at runtime using the WebLogic Server Administration Console. Or, you can attach a subset of policies using the annotations and then attach additional policies at runtime. If you attach a policy file using the JWS annotations, you can remove the policy at runtime using the WebLogic Server Administration Console.
At runtime, the WebLogic Server Administration Console allows you to attach as many policies as you want with a web service and its operations, even if the assertions in the policies contradict each other or contradict the assertions in policies attached at design time using the JWS annotations. It is up to you to ensure that multiple attached policies work together. If any contradictions exist, WebLogic Server returns a runtime error when a client application invokes the web service operation.
There is no policy validation. The following specific combinations are valid:
-
One management policy can be attached to a policy subject.
-
One security policy with subtype authentication can be attached to a subject.
-
One security policy with subtype message protection can be attached to a subject.
-
One security policy with subtype authorization can be attached to a subject.
Note:
There may be either one or two security policies attached to a policy subject. A security policy can contain an assertion that belongs to the authentication or message protection subtype categories, or an assertion that belongs to both subtype categories. The second security policy contains an assertion that belongs to the authorization subtype.
-
If an authentication policy and an authorization policy are both attached to a policy subject, the authentication policy must precede the authorization policy.
Perform the following steps to attach an OWSM security policy via the WebLogic Server Administration Console:
- Select the web service endpoint, as shown in Figure A-1. You can attach OWSM security policies only at the class/port level.
Figure A-1 Service Endpoints for the Web Service
Description of "Figure A-1 Service Endpoints for the Web Service" - Select OWSM, as shown in Figure A-2.
Figure A-2 Selecting the OWSM Security Policy Type
Description of "Figure A-2 Selecting the OWSM Security Policy Type" - If you had instead mistakenly selected a particular web service operation, note that you are not presented with the policy choice screen, as shown in Figure A-3. Click Cancel to start over.
- Select the OWSM security policies that you want to attach to this web service, and use the control to move them into the Chosen Endpoint Policies box, as shown in Figure A-4. Click Finish when done.
Figure A-4 Selecting From the Available OWSM Security Policies
Description of "Figure A-4 Selecting From the Available OWSM Security Policies"
Refreshing the Cache After Attaching Policies
WebLogic Server caches data for a deployed resource, and there is one cache per session. You may need to clear this cache in order to see a policy attached to a web service.
In typical use, the WebLogic Server Administration Console caches the last deployed resource with which a user interacts. Any changes made to a cached deployment by an external tool or API (such as Fusion Middleware Control,WLST, or the JMX API) will not be reflected in the cached version.
Consider the following scenario.
- Assume that you have a web service deployed to WebLogic Server and you navigate to the configuration page of that web service in the WebLogic Server Administration Console. The information for this deployed resource is now cached.
- If you attach an OWSM security policy to this web service using Fusion Middleware Control, the change does not reflect in the WebLogic Server Administration Console, even if you refresh the page.
To see the policy attachment, you need clear the cache. You can do this in two ways:
-
Navigate to another deployment (thus caching it) and then revisit the original page.
-
Log out of the WebLogic Server Administration Console and back in again.
Attaching OWSM Security Policies to JAX-WS Web Service Clients
The following procedure describes the high-level steps to attach an OWSM security policy to a web service client application at design time. See Developing Basic JAX-WS Web Service Clients in Developing JAX-WS Web Services for Oracle WebLogic Server.
Note:
It is assumed that you have created the client application that invokes a deployed web service, and that you want to update it by attaching a client-side policy file. It is also assumed that you have set up an Ant-based development environment and that you have a working build.xml file that includes a target for running the clientgen Ant task.
When you run the client application, it loads the policy files that the web service client runtime uses to enable security for the SOAP request message.
Disabling a Globally Attached OWSM Policy
No behavior policies provide the ability to effectively disable an OWSM policy attached globally in a policy set. Table A-3 lists the no behavior policies that are supported by Java EE web services and clients to disable a globally attached OWSM security policy.
Table A-3 No Behavior Policies Supported by Java EE Web Services and Clients
| No Behavior Policy | Description |
|---|---|
|
OWSM no behavior policies |
OWSM no behavior policies that are valid for Java EE web services and clients include:
See No Behavior Policies in Securing Web Services and Managing Policies with Oracle Web Services Manager. Attach an OWSM no behavior policy directly to the Java EE web service or client using the procedures defined in the following sections in Securing Web Services and Managing Policies with Oracle Web Services Manager: |
|
WebLogic no behavior policy |
The WebLogic no behavior policy, <?xml version="1.0"?>
<wsp15:Policy xmlns:wsp15="http://www.w3.org/ns/ws-policy">
<wsp15:All>
<wsp15:Policy/>
</wsp15:All>
</wsp15:Policy>
Attach the Web service: Web service client: |
See the following sections in Securing Web Services and Managing Policies with Oracle Web Services Manager:
Configuring Policies
You must configure your web service Securing Web Services in Securing Web Services and Managing Policies with Oracle Web Services Manager.
Overriding the Policy Configuration for the Web Service Client
You can override the default configuration properties of an OWSM security policy programmatically at design time using one of the following methods:
-
JAX-WS
RequestContext, as described in Overriding Client Policy Configuration Properties at Design Time in Securing Web Services and Managing Policies with Oracle Web Services Manager. -
@Propertyannotation when attaching an OWSM security policy using the@SecurityPolicyannotation, as described in Attaching Policies to Java EE Web Services and Clients Using Annotations in Securing Web Services and Managing Policies with Oracle Web Services Manager.
Monitoring and Testing the Web Service
You can use either the WebLogic Server Administration Console or Fusion Middleware Control to monitor and test a WebLogic JAX-WS web service that is protected with an OWSM security policy.
To monitor and test the web service from the WebLogic Server Administration Console, perform the following steps:
To monitor and test the web service using the Fusion Middleware Control, see Monitoring and Auditing Web Services and Testing Web Services in Administering Web Services.